Version 1.0 · Last updated: 13 November 2026
This Data Processing Agreement ("DPA") is made under Article 28 of the GDPR. It is part of the Terms of AI Lead Intake Diagnostic ("ALID") and applies whenever Dario processes personal data of your website visitors through ALID. You accept it when you accept the Terms.
1. Parties and roles
- Controller: you, the business that holds the ALID account and runs the widget on its website.
- Processor: Dario Cositore, individual (persona fisica) operating under the laws of Italy, Via Chiosi, 26012 Castelleone (CR), Italy, Codice Fiscale CSTDRA91R11F839X, [email protected].
For his own account and billing data about you, Dario is a separate controller, as described in the Privacy Policy.
2. Subject matter, duration and purpose
The processor handles visitor data only to provide the widget, generate readouts, store leads, deliver them to the destinations you chose, and run the console. Processing lasts as long as your subscription, plus the time needed to delete the data under Section 12.
3. Data subjects and categories of data
- Data subjects: visitors to your website who use the widget, and the people you set up as delivery recipients.
- Data: name, contact details (email or phone), the brief and answers to qualifying questions, the readout, the consent text and time, whether a copy was requested by email, the page address and website, a daily salted IP hash, delivery logs and share links.
- Special categories of data are not intended. You must not set up the widget to ask for them.
4. Instructions
Your documented instructions are the Terms, this DPA and your workspace configuration. The processor follows only these instructions, unless EU or Italian law requires otherwise, in which case he tells you first unless the law forbids it. He tells you right away if he believes an instruction breaks the GDPR. He never uses visitor data for his own purposes, never sells it, and never uses it to train AI models.
5. Confidentiality
Only Dario has access to the data. Anyone he authorizes in the future must be bound by a duty of confidentiality.
6. Security measures
- Encryption in transit with HTTPS (TLS).
- Stored data kept in Cloudflare's EU jurisdiction (database, file storage, key-value storage and queues).
- Raw IP addresses never stored, only hashes with a salt that changes daily and is discarded after 3 days.
- Passwords stored only as hashes; email addresses masked or hashed in logs.
- Least-privilege access, limited to Dario.
- Bot checks, origin checks and rate limits on the public widget.
- Export and deletion tools in the console.
7. Sub-processors
You give general authorization for the sub-processors below. The processor binds each of them to data protection obligations equivalent to this DPA and remains responsible for them. He tells you by email at least 30 days before adding or replacing a sub-processor. You can object; if we can't solve the objection, you can end your subscription and get a pro-rated refund of any prepaid period you didn't use.
- Cloudflare, Inc. (USA): hosting, database, file storage, queues and the Turnstile bot check. Data stored in the EU jurisdiction; requests handled at the nearest Cloudflare location.
- Xiaomi Technologies Singapore Pte. Ltd., with Xiaomi Technology Netherlands B.V. and their affiliates (Xiaomi MiMo): generates the readout from the brief. Data stored on servers in Europe and Singapore. The transfer is covered by the EU Standard Contractual Clauses.
- Plus Five Five, Inc. (Resend), USA: sends lead notifications and readout emails from its EU region (eu-west-1). The transfer is covered by the EU Standard Contractual Clauses.
Waffo Pancake (Waffo.com Limited, Hong Kong) handles billing and Google Ireland Limited handles optional sign-in. Neither receives visitor data.
8. International transfers
Where visitor data leaves the European Economic Area, the transfer is covered by the EU Standard Contractual Clauses (Commission Decision 2021/914) in the sub-processor's data processing agreement.
9. Help with visitors' rights
You can export or delete leads and whole workspaces directly in the console. If a visitor contacts the processor directly, he passes the request to you without undue delay and does not answer it himself unless you ask him to. He helps you answer requests within the time the law sets.
10. Data breaches
If a personal data breach affects your visitors' data, the processor notifies you without undue delay and within 72 hours of becoming aware of it. The notice describes what happened, the categories and approximate number of people and records involved, the likely consequences, and the measures taken or proposed. He keeps you updated as more becomes known.
11. Other assistance
The processor gives you reasonable help with data protection impact assessments and with prior consultation of the supervisory authority, based on the information he has.
12. Deletion or return
You can export your leads at any time. When you delete a workspace, its leads and readouts are erased straight away and only a record without personal data remains. When your subscription ends, remaining visitor data is kept for 90 days, so you can export it, and is then deleted automatically, unless the law requires it to be kept. You get an email notice 3 days before the deletion. During the subscription, leads are deleted when they reach the retention period you set (1 to 24 months, 12 by default), runs without a lead after 30 days and delivery logs after 90 days. Deleted data can remain in Cloudflare's database backups (point-in-time recovery) for up to 30 days before it is overwritten.
13. Audits
The processor gives you the information you need to show that this DPA is respected. He allows audits, including inspections, by you or an auditor you appoint and who is bound by confidentiality, on reasonable written notice and normally no more than once a year. Requests are answered first with written information.
14. Order of precedence
On data protection matters, this DPA takes precedence over the Terms.
15. Governing law
This DPA is governed by Italian law, and the court of Cremona, Italy, has jurisdiction, without prejudice to any mandatory rights under applicable law.
16. Contact
For anything about this DPA or a visitor's rights, write to [email protected], or use the console.
Related: Terms · Privacy Policy